https://timothydspivey.com/blog/Threshold Effects — essays and research notes by Timothy D. Spivey on mandatory breach disclosure, cybersecurity governance, and the practice of data science.en-ushttps://timothydspivey.com/blog/why-threshold-effects.htmlhttps://timothydspivey.com/blog/why-threshold-effects.htmlTue, 25 Aug 2026 12:00:00 GMTThe name comes from econometrics — a relationship that changes character once a variable crosses a critical value. It is also a fair description of everything this blog will be about.https://timothydspivey.com/blog/gulf-coast-who-the-money-moves-through.htmlhttps://timothydspivey.com/blog/gulf-coast-who-the-money-moves-through.htmlMon, 24 Aug 2026 12:00:00 GMTBEAD is finally putting fiber in the ground around northwest Florida and south Alabama. Five years of process decided who gets to build — and it wasn't construction capability that decided.https://timothydspivey.com/blog/a-fair-fight-with-sox-404.htmlhttps://timothydspivey.com/blog/a-fair-fight-with-sox-404.htmlWed, 19 Aug 2026 12:00:00 GMTArguing against myself: SOX Section 404 is the strongest counterexample to this series' thesis. The argument survives — but comes out more precise than it went in.https://timothydspivey.com/blog/say-something-vs-build-something.htmlhttps://timothydspivey.com/blog/say-something-vs-build-something.htmlMon, 17 Aug 2026 12:00:00 GMTThere are rules that require organizations to say something and rules that require them to build something. Only the second kind has a track record of changing what organizations are.https://timothydspivey.com/blog/the-dashboard-is-green.htmlhttps://timothydspivey.com/blog/the-dashboard-is-green.htmlWed, 12 Aug 2026 12:00:00 GMTGoodhart's Law and Campbell's Law warned us fifty years ago: the metric changes what the organization reports, not what the organization is. We built the dashboards anyway.https://timothydspivey.com/blog/what-the-broadband-labels-revealed.htmlhttps://timothydspivey.com/blog/what-the-broadband-labels-revealed.htmlMon, 10 Aug 2026 12:00:00 GMTThe FCC's broadband nutrition labels were identical for all 35 ISPs a 2025 study scored. What the mandate produced depended entirely on what each organization already was.https://timothydspivey.com/blog/wanted-the-best-counterexample.htmlhttps://timothydspivey.com/blog/wanted-the-best-counterexample.htmlWed, 05 Aug 2026 12:00:00 GMTThe honest version of an argument has to survive its best counterexample. So: what's the strongest case of a rule that actually changed what organizations are?https://timothydspivey.com/blog/three-rules-same-outcome.htmlhttps://timothydspivey.com/blog/three-rules-same-outcome.htmlMon, 03 Aug 2026 12:00:00 GMTAI governance, compliance programs, mandatory disclosure: three domains, three rules, same outcome. The rule changes what organizations are required to do. It rarely changes what they are.https://timothydspivey.com/blog/shadow-it-was-the-rehearsal.htmlhttps://timothydspivey.com/blog/shadow-it-was-the-rehearsal.htmlWed, 29 Jul 2026 12:00:00 GMTShadow IT persisted because unsanctioned tools solved real problems faster than approved ones. AI governance is replaying the same dynamic — in months instead of years.https://timothydspivey.com/blog/paper-trails-and-shadow-ai.htmlhttps://timothydspivey.com/blog/paper-trails-and-shadow-ai.htmlMon, 27 Jul 2026 12:00:00 GMTOnly 37% of compliance leaders can measure whether their programs work — and half the U.S. workforce is using AI at work without knowing if it's allowed. Why did we think a document was going to govern a behavior?https://timothydspivey.com/blog/cover-yourself-8-ks.htmlhttps://timothydspivey.com/blog/cover-yourself-8-ks.htmlWed, 22 Jul 2026 12:00:00 GMTWhen the SEC required four-business-day incident disclosure, firms responded with “cover yourself 8-Ks.” Organizations don't respond to regulatory intent — they respond to regulatory incentives.https://timothydspivey.com/blog/the-faster-is-better-assumption.htmlhttps://timothydspivey.com/blog/the-faster-is-better-assumption.htmlMon, 20 Jul 2026 12:00:00 GMTThe assumption behind mandatory breach disclosure timing is that faster equals better. Across 1,054 breach events and three empirical channels, that assumption doesn't hold up well.